Standardiser les scripts créateurs de LXC (template, autologin, update) #16

2026-07-30T12:19:13Z

Damien commented

2026-07-30 12:19:13 +00:00

Retire ferretdb (Debian, hors périmètre — cas particulier DocumentDB)
Factorise lib/common.sh : détection template Alpine, autologin tty1, détection LXC existante, refresh OS
gitea-runner : corrige le template figé en dur, ajoute la détection d'existant + refresh OS en update
Corrige un bug bloquant (logs sur stdout corrompant TEMPLATE) et deux fragilités (sourcing silencieux, SCRIPT_URL non surchargeable)
openbao reste un no-op comportemental — vérifié par diff

- Retire `ferretdb` (Debian, hors périmètre — cas particulier DocumentDB) - Factorise `lib/common.sh` : détection template Alpine, autologin tty1, détection LXC existante, refresh OS - `gitea-runner` : corrige le template figé en dur, ajoute la détection d'existant + refresh OS en update - Corrige un bug bloquant (logs sur stdout corrompant `TEMPLATE`) et deux fragilités (sourcing silencieux, `SCRIPT_URL` non surchargeable) - `openbao` reste un no-op comportemental — vérifié par diff Closes #12, #13, #14, #15

Damien added 10 commits 2026-07-30 12:19:14 +00:00

Remove ferretdb (Debian LXC, no Alpine build for DocumentDB extension) b5ff76232e

FerretDB required Debian (DocumentDB is Debian/RHEL-only, no musl build),
making it an outlier among the Alpine-based LXC creator scripts in this
repo. Dropping it leaves openbao and gitea-runner as the only LXC creator
scripts, both Alpine, which simplifies template/OS handling (see #12).

Closes #13

scaffold: lib/common.sh helper skeleton (refs #12 #14 #15 ) e545a27e9a

lib/common.sh: template detection + autologin + update helpers d0138b742d

openbao,gitea-runner: source lib/common.sh, fix hardcoded Alpine template 51f2474db6

Both install scripts now source lib/common.sh instead of duplicating
detect_latest_alpine_template(), find_existing_lxc(), and the tty1
autologin block. Since these scripts are distributed via curl one-liner
and piped into `pct exec` inside the LXC, there is no local checkout to
source from in those contexts — lib/common.sh is sourced from disk when
a local checkout is available (BASH_SOURCE resolves to a real path),
otherwise fetched over HTTP next to SCRIPT_URL. Both scripts already
require outbound network to curl themselves and to download their
respective binaries, so this adds no new failure mode.

openbao/install.sh is a behavioral no-op: same log output, same control
flow. One inline apk update/upgrade is intentionally left as-is in
update_lxc() — refresh_os_packages() is a bash function in this
process and can't run over `pct exec ... sh -c` without shipping the
function definition into the container.

gitea-runner/install.sh fixes the actual bug: TEMPLATE was hardcoded to
a specific dated Alpine release, so create_lxc() would keep trying to
provision a stale/absent template. TEMPLATE now defaults to empty and
create_lxc() calls detect_latest_alpine_template() when unset, mirroring
openbao. Also renamed HOSTNAME -> HOSTNAME_LXC and added LXC_TAG to
match openbao's naming, since a follow-up (issue #15) will wire up
find_existing_lxc()-based update detection here.

Closes #12, Closes #14

gitea-runner: detect existing LXC on re-run, refresh OS on update 294960f44d

Ports openbao's host-side update path to gitea-runner: main() now uses
find_existing_lxc (hostname/tag match) to switch into a new update_lxc()
instead of always recreating the container, with an explicit --update
dispatch case reaching update_runner() (previously inferred only from
/usr/local/bin/act_runner presence). require_root is ported from openbao
for the host-side pct branch.

Extracted a small exec_in_lxc() helper (option a from the two offered)
rather than duplicating the curl-pipe invocation, since main() now needs
to drive both the create and update paths through the same piping logic
with only the trailing --install/--update flag differing — matching
openbao's own exec_in_lxc for consistency.

update_runner() now calls refresh_os_packages before touching the binary,
mirroring openbao's update_inside_lxc(). Also switched create_lxc's LXC
tag from the hardcoded "cicd" to the LXC_TAG variable (added in the prior
commit but unused until now) so find_existing_lxc's tag match actually
works.

Documented the OS-refresh-on-update behavior in both READMEs.

Closes #15

gitea-runner: fix log_info/warn/error writing to stdout, corrupting TEMPLATE 82540472ae

log_info() etc. wrote to stdout, unlike openbao's identical functions
which write to stderr specifically so $(fn) capture is safe. lib/common.sh's
detect_latest_alpine_template() does `log_info "Selected..."; echo "$tmpl"` —
in gitea-runner, TEMPLATE=$(detect_latest_alpine_template) therefore captured
the log line and ANSI codes along with the template name, breaking both the
pveam list lookup and pct create's template argument.

gitea-runner: make SCRIPT_URL overridable, matching openbao fef37d2676

Was a fixed value, unlike openbao's SCRIPT_URL="${SCRIPT_URL:-...}". Two
consequences: exec_in_lxc forwarded SCRIPT_URL into the container where it
was immediately overwritten by the hardcoded value, making the forward a
no-op; and the lib/common.sh sourcing fallback derives its fetch URL from
SCRIPT_URL, so it always pointed at main (where lib/common.sh doesn't exist
yet), making this branch untestable end-to-end for gitea-runner.

openbao,gitea-runner: fail loudly if lib/common.sh sourcing fails 3e4ede907e

source <(curl ...) swallows curl failures (404, network error): an empty
stream still makes `source` return 0, so the failure would otherwise only
surface later as a confusing "command not found" for one of lib/common.sh's
functions. Check that a known function landed after the source, and exit 1
with the attempted URL if not.

lib/common.sh: fix refresh_os_packages contract, drop set -e, add ensure_template_present 936ab2c2fb

- refresh_os_packages()'s header claimed it was callable both host-side (via
  pct exec) and inside the LXC; it's a plain bash function in this process,
  it cannot cross a pct exec boundary. Corrected to match the comment
  already present at its one host-side non-call-site in openbao/install.sh.
- Removed `set -euo pipefail`: a sourced file must not impose shell options
  on the caller. Both install scripts already set these before sourcing.
- Added ensure_template_present(), ported from openbao/install.sh, so
  gitea-runner can reuse it (issue #12 follow-up) instead of duplicating a
  template-download check that skipped `pveam update` and could silently
  settle for a stale cached template list.

openbao,gitea-runner: use shared ensure_template_present, gitea-runner parity fixes d86848eb71

openbao: removed its now-duplicate ensure_template_present() definition,
using the one factored into lib/common.sh (call site unchanged).

gitea-runner: replaced its ad-hoc template-download check (which skipped
`pveam update`, risking a stale cached template list now that the template
is auto-detected) with a call to the shared ensure_template_present().
Also added ca-certificates to exec_in_lxc's apk add, matching openbao, and
added require_root() to the inside-LXC dispatch path in main(), which
openbao already does but gitea-runner was missing.

Damien merged commit 8299431aed into main

2026-07-30 12:19:38 +00:00

Damien referenced this issue from a commit

2026-07-30 12:19:40 +00:00

Merge pull request 'Standardiser les scripts créateurs de LXC (template, autologin, update)' (#16) from chore/standardize-lxc-scripts into main

Damien deleted branch chore/standardize-lxc-scripts

2026-07-30 12:19:41 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Damien/infra-scripts#16